From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E51B2DF3DA for ; Tue, 30 Jun 2026 08:00:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782806439; cv=none; b=N1TovSxnQY7CHLw1JQ6DPEi7zC4tR2vWzL3MYGqxSU0DkZG4Gk8wpSyhhMu58z5e8Hn27KvJfSmDxkJWIIkCQXa8P6RdliemEr3ZWWK0wmYEacGAVu7sP3Nj5akzzi0TiAg/YgV2Rg/k2eYi1127xmEHHkfkZMdt5pYvm+Zyp/4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782806439; c=relaxed/simple; bh=KvbnJuw1dsIYC55qHxS71LrJG2C/OkHcB+GpqJuwerM=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=ufVitCPzfgn+My7HLGeanw2UptH43OCSMO4dlno6WCymEbI/LoS2hhQrrfjagw8JLrLve7rPUTQmRZyMmgNnsSg1rZcyWQ4zIeBz4fFGhrJNLeLILfliM9onnU8MtiRmCyqRWHh7MSZUMOP48U5yKOZXFJJJEab0FG510y4JMrY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=n+jtMy76; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="n+jtMy76" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B5CE21F000E9; Tue, 30 Jun 2026 08:00:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782806438; bh=aklCtIdwAuaV/IkYc3oYr7mTqO/RWDS/WnA9iYfqABI=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=n+jtMy76AtRUPWNey7Uh6bCpahTZ15+A+d5vimKhXap0eKxXdW+zpGiUzwliEf3Vm /CDYW/kLw2E8/y8UWTfGcI2DZadOm/ejXe1eqqq+oOdlgMfU+QGtuXiGjARIVAFII9 15sMxCzyLbxSFRDkWRVssYHA64gZmOLdmc5zItyorHySHMUKXOnX/PzY0XCDAuqMyU wJXPEew2/xCHf2+tabUGwuX6OqbQKP9JDjQg+L3yW1UJHFVzfgU8+1Qe1C5jddTiCY 9MgBIpJcBb2wbsXLiVo0cNVIuMDmDWufXalyoBjQiWft+4s3XoEhIHwTKWFTyRj6lp ZKxT1nXgRx54w== From: sashiko-bot@kernel.org Subject: Re: [PATCH v3 1/3] phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table Reply-To: sashiko-reviews@lists.linux.dev To: "Gerald Loacker" Cc: robh@kernel.org, devicetree@vger.kernel.org, vkoul@kernel.org, olteanv@gmail.com, conor+dt@kernel.org, linux-phy@lists.infradead.org, neil.armstrong@linaro.org In-Reply-To: <20260630-feature-mipi-csi-dphy-4k60-v3-1-176792ab71fa@wolfvision.net> References: <20260630-feature-mipi-csi-dphy-4k60-v3-0-176792ab71fa@wolfvision.net> <20260630-feature-mipi-csi-dphy-4k60-v3-1-176792ab71fa@wolfvision.net> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 30 Jun 2026 08:00:37 +0000 Message-Id: <20260630080037.B5CE21F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 2 potential issue(= s) to consider: Pre-existing issues: - [High] Valid low-frequency configurations are incorrectly rejected becaus= e a `cfg_bit` value of `0x00` conflicts with the default 'not found' sentin= el. - [High] The `rk3368_grf_dphy_regs` array is missing an explicit size and o= nly initializes index 0, meaning it is compiled as an array of size 1. `roc= kchip_inno_csidphy_power_on()` unconditionally indexes into this array at i= ndices 1 and 2, causing an out-of-bounds read and an erroneous write to an = undefined GRF register offset. -- commit 4cc350ff3a3bfdcb6204ddc2357172385fbe4d2a Author: Gerald Loacker phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table The rk1808 hsfreq table previously capped at 2499 Mbps. This commit extends the final entry to 2500 Mbps to support this exact data rate, which is essential for the RK3588 platform reusing this array. > diff --git a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c b/drivers/p= hy/rockchip/phy-rockchip-inno-csidphy.c > index c79fb53d8ee5c..5281f8dea0ad3 100644 > --- a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c > +++ b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c > @@ -170,7 +170,7 @@ static const struct hsfreq_range rk1808_mipidphy_hsfr= eq_ranges[] =3D { > { 299, 0x06}, { 399, 0x08}, { 499, 0x0b}, { 599, 0x0e}, > { 699, 0x10}, { 799, 0x12}, { 999, 0x16}, {1199, 0x1e}, > {1399, 0x23}, {1599, 0x2d}, {1799, 0x32}, {1999, 0x37}, > - {2199, 0x3c}, {2399, 0x41}, {2499, 0x46} > + {2199, 0x3c}, {2399, 0x41}, {2500, 0x46} > }; [Severity: High] This isn't a bug introduced by this patch, but while reviewing the frequency tables I noticed a potential problem in how the selected configuration is evaluated later in the driver. If a data rate maps to a configuration where the cfg_bit is 0x00, will rockchip_inno_csidphy_configure() incorrectly reject it? In rockchip_inno_csidphy_configure(): if (!hsfreq) return -EINVAL; It seems this check uses 0x00 as a not found sentinel, but valid low frequency ranges might legitimately use 0x00 as their configuration value. This same logic is also present in rk_dphy_configure() in phy-rockchip-dphy-rx0.c. Does this prevent the hardware from operating at those low frequencies? [Severity: High] This is also a pre-existing issue, but I noticed an out-of-bounds array access in this driver for the RK3368 platform. The rk3368_grf_dphy_regs array is initialized with only a single element: static const struct dphy_reg rk3368_grf_dphy_regs[] =3D { [GRF_DPHY_CSIPHY_FORCERXMODE] =3D PHY_REG(RK3368_GRF_SOC_CON6_OFFSET, 4= , 8), }; However, rockchip_inno_csidphy_power_on() unconditionally accesses indices beyond this: write_grf_reg(priv, GRF_DPHY_CSIPHY_CLKLANE_EN, 0x1); write_grf_reg(priv, GRF_DPHY_CSIPHY_DATALANE_EN, GENMASK(priv->config.lanes - 1, 0)); Could this read past the end of the 1-element array and cause an erroneous write to an undefined register offset if the adjacent memory evaluates as valid? --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260630-feature-mi= pi-csi-dphy-4k60-v3-0-176792ab71fa@wolfvision.net?part=3D1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id ABFD1C43458 for ; Tue, 30 Jun 2026 08:00:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=bgeXyT+NIsD5lvNmYd/axvo3behj6JR+CJ6AR0QRka8=; b=h68cGaET5o+Ebd +LMXpb9UyY6vCOcov19mq/EFZEWSUuMLSp/sLAOVJ1k3mfHrZn5nAi1yPDwZEd+gx8I/B+bZ2yYyy uYXuoq5O5oL6uAY68RPxnUnrZDCwamNv2ZSWQ/LMCBzzSJUAodhvaGkRS8skcRnOvtKmw/zx7IOD7 jpldS+qKHsyjsUtZYzrMuHtJ7BAGm0bi5sxgxsTw9y/bUv3a3pjBqmhWHsVuBlkHbWfAPZCM1PNDX jt4PUwMKkPXd5AqjrUkWDzMY5hWcrxFDiPpbU1kXUyYzvw1ofA533MWWVtGi+LT5i1nXBQDIeBY53 C/MV/bQ1kmtIvDrLz7NA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1weTOZ-0000000GELg-1NAO; Tue, 30 Jun 2026 08:00:39 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1weTOY-0000000GELZ-2FpF for linux-phy@lists.infradead.org; Tue, 30 Jun 2026 08:00:38 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 4DBA4403F1; Tue, 30 Jun 2026 08:00:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B5CE21F000E9; Tue, 30 Jun 2026 08:00:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782806438; bh=aklCtIdwAuaV/IkYc3oYr7mTqO/RWDS/WnA9iYfqABI=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=n+jtMy76AtRUPWNey7Uh6bCpahTZ15+A+d5vimKhXap0eKxXdW+zpGiUzwliEf3Vm /CDYW/kLw2E8/y8UWTfGcI2DZadOm/ejXe1eqqq+oOdlgMfU+QGtuXiGjARIVAFII9 15sMxCzyLbxSFRDkWRVssYHA64gZmOLdmc5zItyorHySHMUKXOnX/PzY0XCDAuqMyU wJXPEew2/xCHf2+tabUGwuX6OqbQKP9JDjQg+L3yW1UJHFVzfgU8+1Qe1C5jddTiCY 9MgBIpJcBb2wbsXLiVo0cNVIuMDmDWufXalyoBjQiWft+4s3XoEhIHwTKWFTyRj6lp ZKxT1nXgRx54w== From: sashiko-bot@kernel.org Subject: Re: [PATCH v3 1/3] phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table To: "Gerald Loacker" Cc: robh@kernel.org, devicetree@vger.kernel.org, vkoul@kernel.org, olteanv@gmail.com, conor+dt@kernel.org, linux-phy@lists.infradead.org, neil.armstrong@linaro.org In-Reply-To: <20260630-feature-mipi-csi-dphy-4k60-v3-1-176792ab71fa@wolfvision.net> References: <20260630-feature-mipi-csi-dphy-4k60-v3-0-176792ab71fa@wolfvision.net> <20260630-feature-mipi-csi-dphy-4k60-v3-1-176792ab71fa@wolfvision.net> Date: Tue, 30 Jun 2026 08:00:37 +0000 Message-Id: <20260630080037.B5CE21F000E9@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MiBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpQcmUtZXhpc3RpbmcgaXNzdWVzOgot IFtIaWdoXSBWYWxpZCBsb3ctZnJlcXVlbmN5IGNvbmZpZ3VyYXRpb25zIGFyZSBpbmNvcnJlY3Rs eSByZWplY3RlZCBiZWNhdXNlIGEgYGNmZ19iaXRgIHZhbHVlIG9mIGAweDAwYCBjb25mbGljdHMg d2l0aCB0aGUgZGVmYXVsdCAnbm90IGZvdW5kJyBzZW50aW5lbC4KLSBbSGlnaF0gVGhlIGByazMz NjhfZ3JmX2RwaHlfcmVnc2AgYXJyYXkgaXMgbWlzc2luZyBhbiBleHBsaWNpdCBzaXplIGFuZCBv bmx5IGluaXRpYWxpemVzIGluZGV4IDAsIG1lYW5pbmcgaXQgaXMgY29tcGlsZWQgYXMgYW4gYXJy YXkgb2Ygc2l6ZSAxLiBgcm9ja2NoaXBfaW5ub19jc2lkcGh5X3Bvd2VyX29uKClgIHVuY29uZGl0 aW9uYWxseSBpbmRleGVzIGludG8gdGhpcyBhcnJheSBhdCBpbmRpY2VzIDEgYW5kIDIsIGNhdXNp bmcgYW4gb3V0LW9mLWJvdW5kcyByZWFkIGFuZCBhbiBlcnJvbmVvdXMgd3JpdGUgdG8gYW4gdW5k ZWZpbmVkIEdSRiByZWdpc3RlciBvZmZzZXQuCi0tCgpjb21taXQgNGNjMzUwZmYzYTNiZmRjYjYy MDRkZGMyMzU3MTcyMzg1ZmJlNGQyYQpBdXRob3I6IEdlcmFsZCBMb2Fja2VyIDxnZXJhbGQubG9h Y2tlckB3b2xmdmlzaW9uLm5ldD4KCnBoeTogcm9ja2NoaXA6IHBoeS1yb2NrY2hpcC1pbm5vLWNz aWRwaHk6IGZpeCByazE4MDggaHNmcmVxIHRhYmxlCgpUaGUgcmsxODA4IGhzZnJlcSB0YWJsZSBw cmV2aW91c2x5IGNhcHBlZCBhdCAyNDk5IE1icHMuIFRoaXMgY29tbWl0CmV4dGVuZHMgdGhlIGZp bmFsIGVudHJ5IHRvIDI1MDAgTWJwcyB0byBzdXBwb3J0IHRoaXMgZXhhY3QgZGF0YSByYXRlLAp3 aGljaCBpcyBlc3NlbnRpYWwgZm9yIHRoZSBSSzM1ODggcGxhdGZvcm0gcmV1c2luZyB0aGlzIGFy cmF5LgoKPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9waHkvcm9ja2NoaXAvcGh5LXJvY2tjaGlwLWlu bm8tY3NpZHBoeS5jIGIvZHJpdmVycy9waHkvcm9ja2NoaXAvcGh5LXJvY2tjaGlwLWlubm8tY3Np ZHBoeS5jCj4gaW5kZXggYzc5ZmI1M2Q4ZWU1Yy4uNTI4MWY4ZGVhMGFkMyAxMDA2NDQKPiAtLS0g YS9kcml2ZXJzL3BoeS9yb2NrY2hpcC9waHktcm9ja2NoaXAtaW5uby1jc2lkcGh5LmMKPiArKysg Yi9kcml2ZXJzL3BoeS9yb2NrY2hpcC9waHktcm9ja2NoaXAtaW5uby1jc2lkcGh5LmMKPiBAQCAt MTcwLDcgKzE3MCw3IEBAIHN0YXRpYyBjb25zdCBzdHJ1Y3QgaHNmcmVxX3JhbmdlIHJrMTgwOF9t aXBpZHBoeV9oc2ZyZXFfcmFuZ2VzW10gPSB7Cj4gIAl7IDI5OSwgMHgwNn0sIHsgMzk5LCAweDA4 fSwgeyA0OTksIDB4MGJ9LCB7IDU5OSwgMHgwZX0sCj4gIAl7IDY5OSwgMHgxMH0sIHsgNzk5LCAw eDEyfSwgeyA5OTksIDB4MTZ9LCB7MTE5OSwgMHgxZX0sCj4gIAl7MTM5OSwgMHgyM30sIHsxNTk5 LCAweDJkfSwgezE3OTksIDB4MzJ9LCB7MTk5OSwgMHgzN30sCj4gLQl7MjE5OSwgMHgzY30sIHsy Mzk5LCAweDQxfSwgezI0OTksIDB4NDZ9Cj4gKwl7MjE5OSwgMHgzY30sIHsyMzk5LCAweDQxfSwg ezI1MDAsIDB4NDZ9Cj4gIH07CgpbU2V2ZXJpdHk6IEhpZ2hdClRoaXMgaXNuJ3QgYSBidWcgaW50 cm9kdWNlZCBieSB0aGlzIHBhdGNoLCBidXQgd2hpbGUgcmV2aWV3aW5nIHRoZSBmcmVxdWVuY3kK dGFibGVzIEkgbm90aWNlZCBhIHBvdGVudGlhbCBwcm9ibGVtIGluIGhvdyB0aGUgc2VsZWN0ZWQg Y29uZmlndXJhdGlvbiBpcwpldmFsdWF0ZWQgbGF0ZXIgaW4gdGhlIGRyaXZlci4KCklmIGEgZGF0 YSByYXRlIG1hcHMgdG8gYSBjb25maWd1cmF0aW9uIHdoZXJlIHRoZSBjZmdfYml0IGlzIDB4MDAs IHdpbGwKcm9ja2NoaXBfaW5ub19jc2lkcGh5X2NvbmZpZ3VyZSgpIGluY29ycmVjdGx5IHJlamVj dCBpdD8KCkluIHJvY2tjaGlwX2lubm9fY3NpZHBoeV9jb25maWd1cmUoKToKICAgIGlmICghaHNm cmVxKQogICAgICAgIHJldHVybiAtRUlOVkFMOwoKSXQgc2VlbXMgdGhpcyBjaGVjayB1c2VzIDB4 MDAgYXMgYSBub3QgZm91bmQgc2VudGluZWwsIGJ1dCB2YWxpZCBsb3cKZnJlcXVlbmN5IHJhbmdl cyBtaWdodCBsZWdpdGltYXRlbHkgdXNlIDB4MDAgYXMgdGhlaXIgY29uZmlndXJhdGlvbiB2YWx1 ZS4KVGhpcyBzYW1lIGxvZ2ljIGlzIGFsc28gcHJlc2VudCBpbiBya19kcGh5X2NvbmZpZ3VyZSgp IGluCnBoeS1yb2NrY2hpcC1kcGh5LXJ4MC5jLiBEb2VzIHRoaXMgcHJldmVudCB0aGUgaGFyZHdh cmUgZnJvbSBvcGVyYXRpbmcgYXQKdGhvc2UgbG93IGZyZXF1ZW5jaWVzPwoKW1NldmVyaXR5OiBI aWdoXQpUaGlzIGlzIGFsc28gYSBwcmUtZXhpc3RpbmcgaXNzdWUsIGJ1dCBJIG5vdGljZWQgYW4g b3V0LW9mLWJvdW5kcyBhcnJheQphY2Nlc3MgaW4gdGhpcyBkcml2ZXIgZm9yIHRoZSBSSzMzNjgg cGxhdGZvcm0uCgpUaGUgcmszMzY4X2dyZl9kcGh5X3JlZ3MgYXJyYXkgaXMgaW5pdGlhbGl6ZWQg d2l0aCBvbmx5IGEgc2luZ2xlIGVsZW1lbnQ6CgpzdGF0aWMgY29uc3Qgc3RydWN0IGRwaHlfcmVn IHJrMzM2OF9ncmZfZHBoeV9yZWdzW10gPSB7CiAgICBbR1JGX0RQSFlfQ1NJUEhZX0ZPUkNFUlhN T0RFXSA9IFBIWV9SRUcoUkszMzY4X0dSRl9TT0NfQ09ONl9PRkZTRVQsIDQsIDgpLAp9OwoKSG93 ZXZlciwgcm9ja2NoaXBfaW5ub19jc2lkcGh5X3Bvd2VyX29uKCkgdW5jb25kaXRpb25hbGx5IGFj Y2Vzc2VzCmluZGljZXMgYmV5b25kIHRoaXM6CgogICAgd3JpdGVfZ3JmX3JlZyhwcml2LCBHUkZf RFBIWV9DU0lQSFlfQ0xLTEFORV9FTiwgMHgxKTsKICAgIHdyaXRlX2dyZl9yZWcocHJpdiwgR1JG X0RQSFlfQ1NJUEhZX0RBVEFMQU5FX0VOLAogICAgICAgICAgICAgICAgICBHRU5NQVNLKHByaXYt PmNvbmZpZy5sYW5lcyAtIDEsIDApKTsKCkNvdWxkIHRoaXMgcmVhZCBwYXN0IHRoZSBlbmQgb2Yg dGhlIDEtZWxlbWVudCBhcnJheSBhbmQgY2F1c2UgYW4gZXJyb25lb3VzCndyaXRlIHRvIGFuIHVu ZGVmaW5lZCByZWdpc3RlciBvZmZzZXQgaWYgdGhlIGFkamFjZW50IG1lbW9yeSBldmFsdWF0ZXMg YXMKdmFsaWQ/CgotLSAKU2FzaGlrbyBBSSByZXZpZXcgwrcgaHR0cHM6Ly9zYXNoaWtvLmRldi8j L3BhdGNoc2V0LzIwMjYwNjMwLWZlYXR1cmUtbWlwaS1jc2ktZHBoeS00azYwLXYzLTAtMTc2Nzky YWI3MWZhQHdvbGZ2aXNpb24ubmV0P3BhcnQ9MQoKLS0gCmxpbnV4LXBoeSBtYWlsaW5nIGxpc3QK bGludXgtcGh5QGxpc3RzLmluZnJhZGVhZC5vcmcKaHR0cHM6Ly9saXN0cy5pbmZyYWRlYWQub3Jn L21haWxtYW4vbGlzdGluZm8vbGludXgtcGh5Cg==